Wireshark · Ethereal-users: Re: [Ethereal-users] Capture file

[Guy Harris <guy@xxxxxxxxxx>]

On Tue, Jun 25, 2002 at 06:53:30AM -0500, Beatriz Silva wrote:
> Is there a capture file (that is used by GUI Ethereal to show the
> packet data)?

I assume you're referring to "live" captures, i.e. captures done in
Ethereal itself, rather than capture files that you tell Ethereal to
read (for which the answer is obviously "yes").

If so, the answer is "yes"; *all* Ethereal captures are in files.

> What is its name ?

Live capture files don't have *a* name; they are put in temporary files,
whose name is generated on a per-capture basis.

The capture file will typically be in "/tmp" or "/var/tmp" on UNIX, and
"C:\TEMP" or perhaps, on Windows 2000, in your per-user temporary file
directory on Windows, although it might be a different directory
depending on the setting of the TMPDIR environment variable or, on
Windows, on the setting of the TEMP environment variable.

The name will begin with "etherXXXX" and have a letter and some digits
after it.